@rebasepro/server-postgres 0.12.1-canary.gcfa333c → 0.12.1-canary.gddbd489

package/src/utils/drizzle-conditions.ts

@@ -175,10 +175,11 @@ export class DrizzleConditionBuilder {
     static buildRelationScopeCondition(
         relation: ResolvedRelation,
         /**
-         * Lazy: only `via` and `belongsTo` need the parent's own table. A
-         * foreign key on the target and a junction are both expressible from
-         * the parent's *id* alone, and requiring the table for them would make
-         * a child listing fail on a parent whose table isn't registered.
+         * Lazy: `via`, `belongsTo`, and a foreign key that points at a
+         * `sourceKey` need the parent's own table. A junction and a plain
+         * foreign key are expressible from the parent's *id* alone, and
+         * requiring the table for them would make a child listing fail on a
+         * parent whose table isn't registered.
          */
         parent: () => { table: PgTable<any>; idColumn: AnyPgColumn },
         parentId: string | number,
@@ -239,7 +240,16 @@ export class DrizzleConditionBuilder {
                         `relation '${relation.relationName}'.`
                     );
                 }
-                return eq(fkColumn, parentId);
+                if (!relation.sourceKey) return eq(fkColumn, parentId);
+
+                // A link on a natural key: the foreign key holds a column of the
+                // parent row, not its id, so the parent has to be read. As a
+                // subquery rather than a prior SELECT, for the same reason
+                // `belongsTo` below is — one statement sees one snapshot, and a
+                // scope condition that read the key separately could be built
+                // from a value the very next statement no longer agrees with.
+                const { table, idColumn } = parent();
+                return sql`${fkColumn} = (SELECT ${sql.identifier(relation.sourceKey)} FROM ${table} WHERE ${idColumn} = ${parentId})`;
             }
 
             case "belongsTo": {
@@ -385,7 +395,22 @@ export class DrizzleConditionBuilder {
             // inverse, so reversing it into a filter is a different problem
             // from the two shapes below rather than a third case of them.
             if (relation && (hasForeignKeyOnTarget(relation) || isManyToMany(relation)) && registry && sourceIdColumn) {
-                return { kind: "relation", relation, registry, sourceIdColumn };
+                // The `EXISTS` correlates the target's foreign key with a column
+                // on *this* table, and that is the primary key only when the
+                // link joins on it. A `sourceKey` names a different one, and
+                // correlating on the id anyway silently matches nothing —
+                // "filter by this relation" would quietly return zero rows.
+                const correlationColumn = hasForeignKeyOnTarget(relation) && relation.sourceKey
+                    ? columnAt(relation.sourceKey)
+                    : sourceIdColumn;
+                if (!correlationColumn) {
+                    throw new Error(
+                        `\`sourceKey: "${(relation as ResolvedForeignKeyOnTarget).sourceKey}"\` on relation ` +
+                        `'${relation.relationName}' is not a column on '${collectionPath}', so a filter on ` +
+                        "that relation has nothing to correlate against."
+                    );
+                }
+                return { kind: "relation", relation, registry, sourceIdColumn: correlationColumn };
             }
         }
 

package/src/utils/pg-error-utils.ts

@@ -79,6 +79,25 @@ export function extractPgError(error: unknown): PostgresError | null {
     return null;
 }
 
+/**
+ * Whether the failure came back from Postgres rather than from building the
+ * query — which decides whether a fallback query is worth issuing.
+ *
+ * Reads here run inside a transaction (that is where `SET LOCAL ROLE` binds
+ * RLS). Once a statement raises, that transaction is aborted, and every later
+ * statement on it returns `25P02` — "current transaction is aborted, commands
+ * ignored until end of transaction block". So a retry after a database error
+ * cannot succeed, and it replaces a precise diagnosis ("invalid input syntax
+ * for type uuid") with a generic one. Rethrow instead.
+ *
+ * A query the driver could not even build — a missing reciprocal relation, say
+ * — never reached Postgres, leaves the transaction usable, and is exactly what
+ * the fallback paths exist for.
+ */
+export function reachedDatabase(error: unknown): boolean {
+    return extractPgError(error) !== null;
+}
+
 /**
  * Walk the error cause chain and return the deepest meaningful message.
  */

package/src/websocket.ts

@@ -1,13 +1,13 @@
 import { RealtimeService } from "./services/realtimeService";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
 import type { DataDriver, DeleteProps, FetchCollectionProps, FetchOneProps, SaveProps, TableMetadata, BranchInfo, AuthAdapter } from "@rebasepro/types";
-import { isSQLAdmin, isSchemaAdmin } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, isSQLAdmin, isSchemaAdmin } from "@rebasepro/types";
 import type { User } from "@rebasepro/types";
 
 import { WebSocketServer, WebSocket } from "ws";
 import { Server } from "http";
 import { inspect } from "util";
-import { extractUserFromToken, AccessTokenPayload, safeCompare } from "@rebasepro/server";
+import { extractUserFromToken, AccessTokenPayload, safeCompare, resolveRequireAuth } from "@rebasepro/server";
 import { logger } from "@rebasepro/server";
 
 /** Minimal subset of RebaseAuthConfig used by the WebSocket layer. */
@@ -116,11 +116,20 @@ export function createPostgresWebSocket(
         logger.error("❌ [WebSocket Server] Error", { error: err });
     });
 
-    // Auth is required when either: an adapter is present (secure by default),
-    // OR the config has a jwtSecret and requireAuth !== false.
-    const requireAuth = authAdapter
-        ? true
-        : (authConfig?.requireAuth !== false && !!authConfig?.jwtSecret);
+    // The same predicate the HTTP data routes use, from the same function —
+    // this socket is the other enforcement point for one product decision, and
+    // while it computed the answer itself it computed a different one. See
+    // `resolveRequireAuth` for what its local copy got wrong and why a `false`
+    // here grants access rather than skipping a check.
+    const requireAuth = !!authAdapter || resolveRequireAuth(authConfig as never);
+
+    if (requireAuth && !authAdapter && !authConfig?.jwtSecret && !authConfig?.serviceKey) {
+        logger.warn(
+            "🔐 [WebSocket Server] Authentication is required but no adapter, jwtSecret or " +
+            "serviceKey is configured — no client can complete AUTH, so every realtime " +
+            "message will be refused with UNAUTHORIZED."
+        );
+    }
 
     wss.on("connection", (ws) => {
         const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
@@ -281,7 +290,7 @@ roles: verifiedUser.roles }
                                     roles: session.user.roles ?? []
                                 }
                                 : {
-                                    uid: "anon",
+                                    uid: ANONYMOUS_USER_ID,
                                     displayName: null,
                                     email: null,
                                     photoURL: null,
@@ -620,7 +629,7 @@ colors: true }));
                         const authContext = session?.user
                             ? { uid: session.user.uid,
 roles: session.user.roles ?? [] }
-                            : { uid: "anon",
+                            : { uid: ANONYMOUS_USER_ID,
 roles: ["anon"] };
                         // Let RealtimeService handle these messages
                         await realtimeService.handleClientMessage(clientId, {